Privacy Policy

Dumfries Horsebox Hire ("we", "us", "our") is a horsebox hire business. We are the data controller responsible for your personal data.

Contact Details

• Business Name: Dumfries Horsebox Hire
• Email: dumfrieshorseboxhire@outlook.com
• Phone: 07873 116218

If you have any questions about this privacy policy or how we handle your data, please contact us using the details above.

We collect and process the following categories of personal data:

2.1 Identity Information

• Full name (first name and surname)
• Date of birth (from driving license)
• Driving license number
• Driving license category and entitlements
• License endorsements (penalty points, convictions)
• Photographs (from uploaded driving license)

2.2 Contact Information

• Email address
• Phone number (mobile and landline)
• Home address (from utility bill)
• Postal address

2.3 Financial Information

• Payment card details (last 4 digits only - we don't store full card numbers)
• Billing address
• Payment transaction records
• Stripe customer ID (for payment processing)

2.4 Booking Information

• Booking dates (collection and return)
• Vehicle selected
• Add-ons and extras selected
• Booking reference number
• Special requirements or notes

2.5 Document Images

• UK driving license (front and back photocard)
• Utility bill or bank statement (for proof of address)
• Digital signatures on rental agreements

2.6 Verification Data

• Summaries produced when AI assistance is used to read a document
• DVLA API verification results
• Document authenticity checks
• Fraud detection flags
• Manual review notes (if applicable)

2.7 Technical Information

• IP address
• Browser type and version
• Device information
• Usage data (pages visited, time on site)
• Cookies (see Section 9)

We use your personal data for the following purposes, each with a legal basis under GDPR:

3.1 Processing Your Booking

• Legal Basis: Contract performance (necessary to fulfill your booking)
• To create and manage your booking
• To confirm availability and allocate vehicles
• To send booking confirmations and reminders
• To coordinate collection and return

3.2 Verifying Your Eligibility

• Legal Basis: Legal obligation (insurance requirements) and contract performance
• To verify you meet age requirements (23+ years old)
• To verify you hold the correct driving license category
• To check license validity and status
• To assess insurance eligibility
• To detect fraudulent or altered documents

3.3 Processing Payments

• Legal Basis: Contract performance
• To process rental payments
• To authorise security deposits
• To issue refunds where applicable
• To generate invoices and receipts

3.4 Communication

• Legal Basis: Contract performance and legitimate interests
• To send booking confirmations
• To send pre-collection reminders
• To send deposit authorisation requests
• To respond to inquiries and support requests
• To send important updates about your booking

3.5 Legal Compliance

• Legal Basis: Legal obligation
• To comply with insurance requirements
• To comply with road traffic laws
• To respond to legal requests or court orders
• To maintain records for tax and accounting purposes

3.6 Business Operations

• Legal Basis: Legitimate interests
• To improve our services and website
• To analyze booking patterns and trends
• To prevent fraud and misuse
• To maintain business records

3.7 Marketing (with consent only)

• Legal Basis: Consent
• To send promotional emails (only if you opt-in)
• To send special offers and discounts
• You can unsubscribe at any time

Where AI-assisted checking is switched on for the business you are hiring from, an AI system may read your uploaded documents and produce a summary for the person reviewing them — for example, reading the licence categories or the date on a utility bill. That summary is advice to a human reviewer. It is never the decision.

You can turn this off for your own documents at any time, from Profile → Security in your account. See 4.6 below.

4.1 Anthropic Claude API

What it is: Claude is an advanced AI system developed by Anthropic that can analyze images and extract information.

What data we send to Claude:

• Images of your UK driving license (front and back)
• Images of your utility bill or bank statement
• Your name and address (for verification matching)

What Claude does:

• Reads the text on the document
• Reports the name, address and date of birth it can see
• Reports the licence categories and expiry dates it can see
• Notes anything it could not read clearly, so the reviewer knows to look

It reports what a document appears to say. It does not judge whether the document is genuine, and it does not decide whether to accept it — a member of our team does both.

Data processing by Anthropic:

• Anthropic processes your data in accordance with their Privacy Policy
• Data is encrypted in transit (HTTPS)
• Anthropic does NOT use your data to train their AI models (as per their commercial terms)
• Data is processed temporarily and not retained by Anthropic after analysis
• Processing occurs on Anthropic's secure servers (AWS US/Europe)

4.2 DVLA Driver View API

What it is: The official UK Driver and Vehicle Licensing Agency (DVLA) API for verifying driving licenses.

What data we send to DVLA:

• Your driving license number
• Your date of birth
• Your DVLA "check code" (if provided - this is a code you generate on the DVLA website)

What DVLA provides:

• Official confirmation of license validity
• License status (full, provisional, revoked, suspended)
• License categories and entitlements (e.g., C1 for 7.5T vehicles)
• Endorsements (penalty points and convictions)
• License expiry date

Data processing by DVLA:

• DVLA processes your data in accordance with UK government data protection standards
• Data is used solely for license verification
• Check codes expire after 21 days for security
• DVLA maintains official records of all UK drivers

4.3 How Decisions About Your Documents Are Made

4.4 Data Security During AI Verification

• All document images are encrypted before transmission to AI services
• Data is sent over secure HTTPS connections
• AI providers do not retain your data after processing (per their terms)
• We store the summary produced (not the original images) for 6 months
• Access to verification data is restricted to authorised staff only

4.5 Why We Use AI Verification

Legal Basis: Legitimate interests and legal obligation

• Insurance compliance: Our insurer requires verified licenses
• Fraud prevention: Detects fake or altered documents
• Speed: The reviewer starts from a summary rather than reading every field, so documents are checked sooner
• Consistency: The same details are read from every document, so nothing is skipped on a busy day
• Cost-effectiveness: Reduces the time spent on each check, keeping prices competitive

4.6 Turning AI Checking Off

If you would rather your documents were not read by an AI system, you can turn it off yourself: go to Profile → Security in your account and switch on “Do not use AI to check my documents”. It takes effect immediately and applies to everything you upload from then on.

This does not delay or affect your booking. A person reviews every document before your vehicle is handed over regardless of this setting, so turning it off removes a summary from their screen rather than a step from the process. You will not be charged differently, and you can change your mind at any time.

We let the business you are hiring from know you have chosen this, so they know to expect no summary alongside your documents. They are not told why, and you do not need to give a reason.

We share your personal data with the following third parties:

5.1 Essential Service Providers

5.2 Legal Obligations

We may share your data with:

• Law enforcement agencies (if required by law)
• Courts or tribunals (if subject to legal proceedings)
• Regulatory authorities (e.g., ICO if requested)
• Tax authorities (HMRC for accounting purposes)

5.3 Insurance Providers

• We share minimal necessary data with our insurance provider
• This includes: name, date of birth, license details, booking dates
• Required for insurance coverage validation

5.4 No Marketing Third Parties

We do NOT sell, rent, or share your data with third-party marketers.You will only receive marketing from us (and only if you opt-in).

We take data security seriously and implement industry-standard measures:

6.1 Technical Measures

• Encryption: All data encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Secure storage: Documents stored in Supabase secure storage with access controls
• Database security: PostgreSQL with row-level security (RLS) policies
• Authentication: Secure authentication via Supabase Auth
• Regular backups: Automated daily backups with encryption
• Firewall protection: Web application firewall (WAF) to prevent attacks

6.2 Organizational Measures

• Access controls: Staff access limited to necessary data only
• Staff training: All staff trained on data protection
• Confidentiality agreements: Staff bound by confidentiality clauses
• Regular reviews: Security practices reviewed quarterly
• Incident response: Data breach procedures in place

6.3 Third-Party Security

• All third-party processors are GDPR-compliant
• Data Processing Agreements (DPAs) in place with all processors
• Regular security audits of third-party services

We retain your data for different periods depending on the type:

Retention Periods

After Retention Period

Once the retention period expires:

• Data is securely deleted or anonymized
• Document images are permanently deleted from storage
• Backups containing old data are purged
• AI verification data is deleted

Exception: We may retain anonymized, aggregated data indefinitely for statistical analysis (e.g., "100 bookings in January"). This cannot identify you personally.

Under UK GDPR, you have the following rights:

Our website uses cookies to enhance your experience:

Essential Cookies (Always On)

• Authentication: Keep you logged in
• Session management: Remember your booking in progress
• Security: CSRF protection

Analytics Cookies (Optional)

• Track website usage to improve experience
• Anonymized data only
• You can opt-out via cookie banner or browser settings

Managing Cookies

You can control cookies via:

• Our cookie banner (shown on first visit)
• Your browser settings (see browser help for instructions)
• Note: Disabling essential cookies may affect website functionality

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements.

How We Notify You

• We'll update the "Last updated" date at the top of this page
• For significant changes, we'll email you (if we have your email)
• We may show a notification banner on the website

We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding your personal data:

Response Time: We aim to respond to all data protection requests within 1 month. If your request is complex, we may extend this by 2 months and will notify you.